docx/encryption-envelope-detection

Metadata

XPath assertions

Render assertions

No render assertions declared.

Manifest (expanded)

{
  "$schema": "../manifest.schema.json",
  "id": "docx/encryption-envelope-detection",
  "title": "Encryption envelope detection (OLE compound file)",
  "format": "docx",
  "category": "packaging",
  "summary": "Detect an ECMA-376 Part 2 Annex K encrypted OOXML package by its OLE Compound File signature.",
  "roles": [
    "authoring"
  ],
  "spec": {
    "source": "ecma-376-5-part-2",
    "clause": "Annex K",
    "notes": "An encrypted OOXML package is NOT a ZIP — ECMA-376 Part 2 Annex K wraps the ZIP-encoded package inside an OLE Compound File (the same container format used by legacy .doc). The envelope begins with the OLE header signature `D0 CF 11 E0 A1 B1 1A E1` (8 bytes at offset 0). Readers detect encryption at that layer, before any ZIP parse can succeed. The underlying cryptography is specified by [MS-OFFCRYPTO]; writing an encrypted package requires AES-CBC + a hashed password (or the `VelvetSweatshop` no-password magic). This manifest is detection-only: the assertion targets the OLE magic, not the encrypted content. python-docx (as of 2026.05) raises `EncryptedDocumentError` as soon as this header is seen."
  },
  "fixtures": {
    "machine": "docx/encryption-envelope-detection"
  },
  "assertions": [
    {
      "id": "ole-compound-file-magic",
      "kind": "magic_bytes",
      "offset": 0,
      "must": "equal",
      "value": "D0 CF 11 E0 A1 B1 1A E1",
      "description": "Bytes 0-7 of the encrypted OOXML package MUST be the OLE Compound File signature. Any tool that mis-detects an encrypted package as a ZIP will fail here."
    }
  ]
}